FAQ

FFDec Frequently asked questions (FAQ)

"Invalid SWF file, wrong signature" on opening file with .swf extension, what's that?

This message means that you are opening file which is not really the SWF. FFDec can process only valid SWF files - those which can be played in Flash player. SWF file extension is not enough - also file structure must be compliant with SWF standard - it needs to start with FWS, CWS or ZWS bytes. If you are 100% sure there is something SWF related inside your file, then it probably needs some kind of decryption/unpacking routine first. Go where you got the file and search for an unpacking routine (loader), maybe you find something. FFDec cannot help you with this since decryption routine can be literally anything.

When running FFDec.exe on Windows on my machine, nothing happens after the splashscreen, why?

That's surely a bug. Please try running the app from commandline using ffdec.bat file or java -jar ffdec.jar and then report any errors that it prints out to the issue tracker.

Direct editation of ActionScript gives me an error, what can I do?

Direct editation of AS is experimental - it might damage your SWF file. You can try to report such kind of error to our issue tracker, always attach your SWF file. Then we can take a look.

Can you implement new feature for me?

Try asking in the issue tracker. Decompiler is opensource, you can also implement feature yourself.

Do you fix bugs?

I try to fix them. Please use the issue tracker to report them.

Why don't you use GitHub issues section - why custom issue tracker?

Our custom issue tracker is not the best site ever made, but besides Github issues, it provides us with some special advantages, like private issues (the one visible only to developers, not public).

In the past, I thought many times about migrating to GitHub issues, but there is the problem with private issues, I don't know how to handle that. That would mean to disable private issues. To my knowledge, GitHub does not provide such functionality.

The secondary problem is issue numbering, as some issue numbers in the GitHub are already taken by pull requests, we cannot easily import all issue numbers 1:1, which is really bad.

I also do not want to have two separate issue tracking systems - with two issue numberings.

Is there a documentation for FFDec library?

There is some info in the README.md file.

ActionScript view gives me StackOverFlowError, even if I increase limits in settings, what can I do?

This can be caused by obfuscation. You can try enabling Automatic deobfuscation in settings. If it does not help then see following: Some large scripts require larger nesting than java supports in its default settings. These default settings can be overriden. In FFDec, you can enable larger stack size by modifying file ffdec.bat (Windows) or ffdec.sh (Linux) and then starting the decompiler with these files. (Instead of for example ffdec.exe on Windows)

In ffdec.bat, modify lines

set MEMORY=1024m

to a larger value, for example

set MEMORY=2048m

You need a 64bit java and OS to set larger value than 1024m

In the same file, modify line

rem set STACK_SIZE=32m

to

set STACK_SIZE=32m

This will increase the default stack size. You can then try starting FFDec with ffdec.bat. You can experiment with STACK_SIZE value.

On Linux or MacOS, these settings are similar, but in the file ffdec.sh instead.

What's that thing with § character in scripts?

A) Variable identifiers which have invalid characters in their name are displayed in the form §name§ (for example §s-r/rg§ ). This allows easier direct editation.

B) Also, there exist few special instructions/functions with prefix §§:

• §§push(item) - pushes item on stack
• §§pop() - pops from stack
• §§dup() - duplicates value on stack
• §§goto(label) - jump to address1 (not compilable)
• §§constant(number) - unresolved constant in AS1/2 (unknown constantpool)
• §§multiname(index) - unresolved multiname in AS3 (not compilable)
• §§hasnext(object,index) - hasnext or hasnext2 AS3 instruction
• §§newactivation() - newactivation AS3 instruction
• §§nextname(index,object) - nextname AS3 instruction
• §§nextvalue(index,object) - nextvalue AS3 instruction
• §§enumeration() - generated by ActionEnumerate or ActionEnumerate2 in AS1/2 (not compilable)
• §§enum_assign() - used by enumeration in AS1/2 (not compilable)
• §§findproperty(name) - findproperty call in AS3 (not compilable)
• object.§§slot[index] - unresolved slot index on object in AS3 (not compilable)
• §§newclass(name,baseType) - newclass AS3 instruction (not compilable)
• §§method(index) - newfunction AS3 instruction which was detected as recursive (not compilable)
• §§namespace("url") - unresolved custom namespace on traits

These functions usually pop out when you try to decompile some obfuscated / unstructured code. You can try Settings/Automatic deobfuscation option for handle some kinds of this code properly.

What's that weird escape sequence \{NN}C, \{120}H, etc.?

To avoid displaying long obfuscated names, FFDec can use so called repeating escape sequence \{NN}C, for example \{50}K means 50 K characters in a row.

These escape sequences are used in obfuscated names (like § bad\{75} - *name§) and also in P-code for all strings (like "string of \{150}L").

Default limit is 20 consequent characters - all above will be shortened with the escape. The limit can be raised in Advanced settings / Limits.

This is the way to safely display and edit long obfuscated identifiers consisting of same characters.